2355df7559b137125f35cc373a6fe4bd967b91fd207e705868f6d25a1e60003f

Analysis

Target

2355df7559b137125f35cc373a6fe4bd967b91fd207e705868f6d25a1e60003f.exe
Size

4.2MB
MD5

470602a8aa144556803374fb94a210aa
SHA1

a04b54e71646fd4f70fec7a24b44932079755f5e
SHA256

2355df7559b137125f35cc373a6fe4bd967b91fd207e705868f6d25a1e60003f
SHA512

24020ea5d03d5b4527d24b7cc531729771e714e180d85fca8b1a8e01211f1e21fb339ffdcd6d04c1df8a1c2414fe281d86039be025ea92c72ffb3325cc1221eb

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
268	InstallUtil.exe

Loads dropped DLL 1 IoCs

pid	Process
1588	2355df7559b137125f35cc373a6fe4bd967b91fd207e705868f6d25a1e60003f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 268	1588	2355df7559b137125f35cc373a6fe4bd967b91fd207e705868f6d25a1e60003f.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1588	2355df7559b137125f35cc373a6fe4bd967b91fd207e705868f6d25a1e60003f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	2355df7559b137125f35cc373a6fe4bd967b91fd207e705868f6d25a1e60003f.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 268	1588	2355df7559b137125f35cc373a6fe4bd967b91fd207e705868f6d25a1e60003f.exe	27
PID 1588 wrote to memory of 268	1588	2355df7559b137125f35cc373a6fe4bd967b91fd207e705868f6d25a1e60003f.exe	27
PID 1588 wrote to memory of 268	1588	2355df7559b137125f35cc373a6fe4bd967b91fd207e705868f6d25a1e60003f.exe	27
PID 1588 wrote to memory of 268	1588	2355df7559b137125f35cc373a6fe4bd967b91fd207e705868f6d25a1e60003f.exe	27

C:\Users\Admin\AppData\Local\Temp\2355df7559b137125f35cc373a6fe4bd967b91fd207e705868f6d25a1e60003f.exe
"C:\Users\Admin\AppData\Local\Temp\2355df7559b137125f35cc373a6fe4bd967b91fd207e705868f6d25a1e60003f.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
  C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
  2⤵
  - Executes dropped EXE
  PID:268

memory/1588-54-0x000007FEF5123000-0x000007FEF5124000-memory.dmp

Filesize
4KB

Download
memory/1588-55-0x00000000008B0000-0x0000000000CE6000-memory.dmp

Filesize
4.2MB

Download
memory/1588-56-0x00000000007C0000-0x00000000007E0000-memory.dmp

Filesize
128KB

Download
memory/1588-57-0x000000001C240000-0x000000001C242000-memory.dmp

Filesize
8KB

Download
memory/1588-58-0x0000000000860000-0x00000000008A0000-memory.dmp

Filesize
256KB

Download